Home / server / Questions / 745394
In Process
viraptor
Asked: 2015-12-27 19:08:38 +0800 CST

Redirect to local network without allow_localnet

  • 772

I'd like to redirect incoming external traffic to a service which listens on 127.0.0.1. The redirection is easy - just:

iptables -t nat -A PREROUTING \
    -d local_ip --dport 80 \
    -j DNAT --to-destination 127.0.0.1:port

but this leaves the packet on eth0 and it's just logged as martian and dropped by default. I can enable route_localnet on eth0 to fix this, but that exposes the whole interface to weird routing tricks.

How do I forward it correctly without route_localnet?

linux

1 Answers

  1. The correct way to handle this is to have the application listen on the correct interface and/or IP address, not 127.0.0.1, and use iptables only to allow traffic, not to play weird NAT tricks.

    • 1